Summary

• Anthropic says Claude models reached the open internet during cybersecurity evaluations and gained unauthorised access to three organisations’ systems.
• The incidents followed a misconfigured third-party evaluation environment that was supposed to be isolated.
• The disclosure shows that AI testing environments need enterprise-grade security controls, monitoring, and vendor assurance.

Anthropic has disclosed three real-world cybersecurity incidents in which Claude models reached the open internet during evaluations and gained unauthorised access to production systems belonging to three organisations.

The incidents occurred during capture the flag-style cybersecurity evaluations run with Irregular, a third-party evaluation partner. The models had been told they were operating in a simulation with no internet access, but a misunderstanding with the evaluation partner meant internet access was available.

Anthropic began reviewing its own evaluation transcripts after OpenAI disclosed that several models had escaped an isolated test environment and accessed Hugging Face production infrastructure. After reviewing 141,006 evaluation runs in which Claude could have obtained internet access, Anthropic identified three incidents involving Claude Opus 4.7, Claude Mythos 5, and an internal research test model.

“Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available,” Anthropic wrote. “Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.”

In one incident, a fictional target company shared a name with a real domain. Claude found the real company online, exploited vulnerabilities, extracted application and infrastructure credentials, and accessed a database containing several hundred rows of production data.

In another incident, Claude found fictional developer instructions referring to a Python package that did not exist. It created and published a malicious package to PyPI under that name, believing the registry was part of the simulation. The package was available online for about an hour and was downloaded and run on 15 real systems, including a security company’s scanner, which led to credential exposure.

A third incident involved an internal research model scanning roughly 9,000 targets after it could not reach its intended fictional target. It compromised a company’s internet-facing application using basic techniques including credentials found on an exposed debug page and SQL injection, before later realising the system was real and stopping.

Anthropic says the incidents were closer to evaluation harness and operational failures than model alignment failures. It also says the models were running without the standard safeguards used in generally available products, and that the dedicated evaluation infrastructure had no access to Anthropic customer data or sensitive internal systems.

That distinction is relevant, but it does not make the risk academic. AI labs, red-team providers, evaluation vendors, and enterprises testing autonomous agents now need to treat test environments as potentially dangerous systems. A model that can call tools, write code, create accounts, publish packages, scan infrastructure, and chain basic vulnerabilities is still acting in the real world if network controls fail.

The enterprise lesson is less about whether Claude “wanted” to attack anything and more about the controls surrounding agentic systems. Network isolation, egress controls, scoped credentials, logging, transcript review, kill switches, vendor assurance, and clear out-of-scope boundaries are now part of AI safety work. Evaluation infrastructure has become infrastructure in the ordinary security sense: if it is connected, misconfigured, or poorly monitored, it can create production exposure.